Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/01/2025, 17:05 UTC

General

  • Target

    JaffaCakes118_7ad1196c9f3cf56ec661ff6d6d69c5e0.exe

  • Size

    659KB

  • MD5

    7ad1196c9f3cf56ec661ff6d6d69c5e0

  • SHA1

    05684ab4d6b463f04be533f2406ca0f809db9d0f

  • SHA256

    04f04a07d900cda96cdebd631a95f177bb0f51caa5d780e931390a3dfdade68c

  • SHA512

    e56c09cec9fd6bec546edc3005e2e0a464cda0acea07408aa3142d1a9badbce9703bb91540bad23ea81b8b0ee9bf339528bcdec27585c3d7ad9453e4ed7cc747

  • SSDEEP

    12288:O9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/he:aZ1xuVVjfFoynPaVBUR8f+kN10EBU

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

46.105.250.97:1604

Mutex

DC_MUTEX-3TMAVLG

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    l152Z1g7L1AT

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ad1196c9f3cf56ec661ff6d6d69c5e0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ad1196c9f3cf56ec661ff6d6d69c5e0.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ad1196c9f3cf56ec661ff6d6d69c5e0.exe" +s +h
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ad1196c9f3cf56ec661ff6d6d69c5e0.exe" +s +h
        3⤵
        • Sets file to hidden
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2692
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2092
    • C:\Windows\SysWOW64\notepad.exe
      notepad
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2792
    • C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
      "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2728
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2124

Network

    No results found
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    152 B
    120 B
    3
    3
  • 46.105.250.97:1604
    msdcsc.exe
    52 B
    40 B
    1
    1
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

    Filesize

    659KB

    MD5

    7ad1196c9f3cf56ec661ff6d6d69c5e0

    SHA1

    05684ab4d6b463f04be533f2406ca0f809db9d0f

    SHA256

    04f04a07d900cda96cdebd631a95f177bb0f51caa5d780e931390a3dfdade68c

    SHA512

    e56c09cec9fd6bec546edc3005e2e0a464cda0acea07408aa3142d1a9badbce9703bb91540bad23ea81b8b0ee9bf339528bcdec27585c3d7ad9453e4ed7cc747

  • memory/1268-0-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/1268-66-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2124-65-0x00000000001A0000-0x00000000001A1000-memory.dmp

    Filesize

    4KB

  • memory/2728-68-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2728-69-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2728-70-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2728-74-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2792-17-0x0000000000150000-0x0000000000151000-memory.dmp

    Filesize

    4KB

  • memory/2792-3-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.